To put Google Workspace email on a WordPress domain, leave the website’s A and CNAME records in place and change mail-related DNS records at the service that hosts your domain’s authoritative DNS. Verify ownership with a Google TXT record, replace competing MX records with Google’s current smtp.google.com record, activate Gmail in the Admin console, then publish SPF, DKIM and DMARC for reliable delivery. The WordPress editor itself is usually not where these records are managed.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What changes when you add Google Workspace email
Your website and your email use the same domain name but different DNS record types. A browser reaching www.example.com follows an A or CNAME record to the web host. A mail server delivering to [email protected] looks up the domain’s MX records instead. Google’s Admin Help describes the process this way: when someone sends email, the sender’s computer looks up the MX records for the recipient’s email domain.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →That separation means changing MX, TXT and DKIM records does not normally move or disable a WordPress site. Keep the A and CNAME records that serve the site. Edit only the mail and verification records at the authoritative DNS provider. If you replace nameservers or delete web records while trying to configure email, the website can go offline; an MX change by itself should not do that.
The records you will use
| Record | Purpose | Typical host/name | Value or action |
|---|---|---|---|
| TXT | Proves domain ownership to Google | Root, often @ |
Unique google-site-verification=… value from Google |
| MX | Routes incoming mail | Root, often blank or @ |
smtp.google.com, priority 1 for new setups |
| TXT (SPF) | Lists authorized outbound senders | Root, often @ |
For Google-only sending: v=spf1 include:_spf.google.com ~all |
| TXT (DKIM) | Cryptographically signs outgoing mail | Selector such as google._domainkey |
Public key generated in the Admin console |
| TXT (DMARC) | Publishes handling and reporting policy | _dmarc |
Policy you choose after checking SPF/DKIM alignment |
| A/CNAME | Continues serving the WordPress site | Your existing web hosts | Do not remove merely to configure email |
Before you edit DNS
Have the required access
- A Google Workspace subscription and an administrator account.
- Control of the domain’s DNS records, or access to the person or company that controls them.
- The exact domain you want to use for user addresses, such as
example.com. - A list of every system that sends mail as that domain, including WordPress forms, transactional plugins, a customer relationship management system, an SMTP relay and marketing software.
- A way to record the current DNS values before changing anything. Export or copy the zone when the provider offers that option.
Do not assume that the WordPress dashboard is the DNS control point. WordPress is the publishing platform; DNS may be managed by your registrar, a separate DNS service, a hosting company or WordPress.com.
Understand your nameserver arrangement
Look up the domain’s nameservers at the registrar or in a DNS-checking service you already trust. The organization listed by the authoritative nameservers is where the TXT and MX records must be created. A record entered at a different provider can look correct in its interface but never reach the public DNS.
Some domains use WordPress.com nameservers. Others point A records to WordPress.com while retaining nameservers at the registrar or another DNS provider. In the latter arrangement, WordPress.com’s guidance is to add Google Workspace records at that external DNS provider. A self-hosted WordPress installation follows the same principle: use the registrar, hosting company or DNS service named by the domain’s nameservers.
Recommended Free Tools
Step 1: verify ownership with Google’s TXT record
- Open the Google Workspace setup flow or Admin console with an administrator account.
- Choose the option to verify your domain. Google will display a unique value beginning with
google-site-verification=. - Open the authoritative provider’s DNS manager and create a TXT record at the domain root. Providers label the host as blank,
@or the bare domain; use the format that provider documents for the root. - Paste the complete verification value into the TXT content field. Do not add quotation marks unless the DNS interface adds them automatically, and do not alter capitalization or punctuation.
- Save the record, return to Google’s setup tool and select the verification button.
DNS verification proves that the person configuring Workspace controls the domain; it does not change your website. Google’s Admin Help says DNS records are the best way to ensure the owner of a domain is the one signing up for Workspace. Recognition can take up to 72 hours, so a pending message shortly after saving is normal.
If verification remains pending
- Confirm the record is at the root, not at
wwwor another subdomain. - Check that you entered the record at the authoritative nameserver provider.
- Make sure the full value was copied and that the provider did not append the domain twice.
- Check public DNS from more than one network after allowing propagation time. Do not create several different verification TXT records unless Google specifically asks for another value.
Step 2: route incoming mail with the current MX record
New Google Workspace configurations
At the same authoritative DNS host, add one MX record with these settings:
| Field | Value |
|---|---|
| Type | MX |
| Name or host | Blank or @, according to the provider’s root-domain format |
| Priority | 1 |
| Destination or mail server | smtp.google.com |
Google’s current instruction is: “The Google Workspace MX record value is smtp.google.com.” The priority number is lower for this record than for any backup route, so do not leave an old provider’s MX records with equal or competing preference.
Remove conflicting MX records
Delete stale MX records for a previous mailbox provider, forwarding service or web host unless you intentionally maintain a split-delivery design and have configured that design with an administrator. Two unrelated sets of MX records can send different messages to different systems, producing the common symptom of being able to send but not receive.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
Accounts started before 2023 may still display legacy records beginning with aspmx. A working legacy configuration does not need to be changed solely because its values differ from the current smtp.google.com instruction. For a new setup, use the current value above; for an established account, change records only as part of a planned migration and follow the Admin console’s instructions.
Do not touch the website records
Leave the A and CNAME records that point the root and www hosts to WordPress. MX records are consulted for mail, while A and CNAME records continue to answer web requests. If your provider offers a proxy or traffic-acceleration toggle, use its normal DNS-only controls for MX and TXT records; mail and verification records are not website proxy targets.
Step 3: activate Gmail in the Admin console
- Sign in to the Google Admin console.
- Open Account > Domains > Manage domains.
- Select the domain you verified.
- Choose Activate Gmail and follow the confirmation prompts.
Activation requires an administrator with the relevant domain-settings privilege. Google may not recognize the new MX record immediately. If the activation screen reports that records are missing right after publication, wait for DNS propagation and check the public record before changing anything again.
Test receipt and sending
- Send a message from an outside account to a new Workspace mailbox.
- Reply from Gmail to that outside account.
- Inspect the message headers or authentication results to see whether SPF and DKIM pass once those records are published.
- Test every address used by your website, including a contact form, password-reset message and order or booking notification.
Do not treat a successful outbound test as proof that MX is correct. Outbound mail can work through Gmail or a plugin’s SMTP service while inbound delivery still follows stale MX records.
Step 4: publish SPF for every legitimate sender
Start with an inventory
SPF is a DNS policy naming servers allowed to send mail for your domain. Google says SPF helps prevent outgoing email from being marked as spam by receiving servers. Google Workspace may be only one sender. A WordPress contact-form plugin, transactional service, CRM, SMTP relay or marketing platform can send independently.
Write down each sender before creating the record. Check the plugin’s documentation or its message headers to identify the service actually used; changing MX records does not reconfigure a WordPress plugin’s outbound SMTP or API connection.
Rank #3
Create one SPF record
If Google Workspace is the only sender, Google’s example is:
v=spf1 include:_spf.google.com ~allIf other services send as the same domain, combine their authorized mechanisms in this single SPF record according to each service’s instructions. Never publish multiple SPF records for one domain. Multiple independent v=spf1 TXT records can cause receivers to treat SPF as invalid.
SPF authentication can take up to 48 hours to start working after publication. Keep the policy aligned with your actual senders: remove services you retire, add new services before they begin sending, and avoid authorizing broad networks when a provider supplies a narrower include.
Step 5: configure DKIM signing
- In the Admin console, open Gmail authentication settings and choose the domain.
- Generate a new DKIM key. Google will show a selector and the public-key TXT value.
- At the authoritative DNS provider, create a TXT record using the selector host Google supplies. A common selector is
google._domainkey, but use the exact selector shown for your domain. - Paste the complete public key into the TXT content field and save it.
- Return to Gmail authentication and choose the option to start authentication.
Google states that DKIM can take up to 48 hours after the DNS key is added. The selector is part of the DNS name, so a typo in the selector or a missing _domainkey label prevents Gmail from finding the key even when the public-key text itself is correct.
What DKIM does not fix
DKIM signs mail from systems configured to use Google’s signing service. It does not automatically sign messages sent directly by a WordPress plugin or a third-party relay. Those senders need their own authenticated configuration, and their domains or selectors must be included in your overall SPF, DKIM and DMARC plan.
Step 6: add DMARC after checking alignment
DMARC tells receiving servers what to do when a message fails authentication and where to send aggregate or forensic reports. Add it after you have confirmed that Gmail and every legitimate WordPress or third-party sender passes SPF or DKIM with the visible From domain aligned.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A safe rollout sequence
- Confirm that Google Workspace mail passes DKIM and SPF.
- Send test messages from each WordPress and external service and inspect their authentication results.
- Publish a DMARC TXT record at
_dmarcwith a monitoring policy and a reporting address controlled by you. - Review reports, correct legitimate failures and only then consider a stricter enforcement policy.
The exact DMARC policy syntax depends on your reporting and enforcement needs. Do not copy a policy designed for another domain without replacing its reporting address and evaluating its operational impact.
Gmail sender thresholds
Gmail’s sender guidance requires SPF or DKIM for all senders. Senders delivering more than 5,000 messages per day to Gmail accounts must use SPF, DKIM and DMARC and meet additional requirements; that guidance has applied since February 1, 2024. A small WordPress site may not reach that volume, but publishing all three controls improves trust and gives you a safer path if traffic grows.
WordPress.com and self-hosted WordPress: which instructions apply?
| Situation | Where DNS is edited | What remains pointed to WordPress | Email action |
|---|---|---|---|
| WordPress.com nameservers | WordPress.com domain or DNS settings | Existing web records managed there | Add Google TXT, MX, SPF, DKIM and DMARC in that DNS interface |
| WordPress.com site with external nameservers | The registrar or DNS provider named by those nameservers | A/CNAME records for the WordPress.com site | Add all Google records at the external provider, not only in the WordPress dashboard |
| Self-hosted WordPress | Registrar, hosting company or separate DNS service | A/CNAME records for the server | Add Google records at the authoritative DNS host |
The determining factor is nameserver authority, not whether WordPress files are hosted by WordPress.com or on your own server. If you are unsure, ask the person who registered the domain which service controls its nameservers before editing records.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Propagation, timing and verification
DNS changes are cached by recursive resolvers. Google allows up to 72 hours for MX and TXT recognition in its setup guidance. SPF and DKIM authentication can take up to 48 hours after publication. Those are upper-bound operational windows, not guarantees that every resolver will update at the same moment.
Free tools Windows power users keep installed
One-click scans. No signup required.
A practical test schedule
- Immediately: confirm the record is saved in the authoritative DNS interface and that no duplicate or conflicting MX record was created.
- After a short wait: query public DNS for the root TXT verification value and the MX destination.
- Within 48 hours: test SPF and DKIM authentication from Gmail and your WordPress senders.
- By 72 hours: if Google still cannot see MX or TXT, recheck nameserver authority, host-name formatting and copied values before contacting support.
Changing a record repeatedly can extend confusion because different resolvers may cache different answers. Make one correction, note the time, and retest after caches have had an opportunity to expire.
Troubleshooting common failures
I can send mail but cannot receive it
- Query the domain’s public MX records.
- Confirm that
smtp.google.comwith priority 1 is present for a new setup, or that your intentionally retained legacy configuration is intact. - Remove stale MX records for the former provider.
- Verify that the record was added at the authoritative DNS host rather than a secondary dashboard.
- Wait for propagation and send a new external test message.
Outbound success does not change inbound routing. Gmail, a WordPress plugin or an SMTP relay can send successfully while the domain still advertises another provider for receipt.
Google says the domain is not verified
Inspect the root TXT record character by character, check the nameserver provider, and allow up to 72 hours. A verification value placed on www or another subdomain will not verify the bare domain used by Workspace.
Messages land in spam
Publish SPF, configure DKIM and add DMARC after confirming alignment. Include every legitimate WordPress and third-party sender in the single SPF record. Review the headers of a spammed message to identify which mechanism failed instead of adding random records.
WordPress forms still use the old mail system
Find the form plugin’s SMTP, API or mail-service settings. MX controls where replies to your domain arrive; it does not alter the plugin’s outbound connection. Reconfigure the plugin to use an authorized sender, then update SPF and DKIM for that service as required.
A DNS proxy setting is confusing the setup
Use the provider’s standard DNS-only editor for MX and TXT records. Proxy controls intended for web traffic do not apply to mail routing or ownership-verification records.
Final cutover checklist
- The authoritative nameserver provider is identified.
- The Google verification TXT record is published at the root.
- The current MX record is
smtp.google.comwith priority 1 for a new account, and conflicting records are removed. - A/CNAME records for the WordPress site remain unchanged.
- Gmail is activated under Account > Domains > Manage domains.
- One SPF record authorizes Google and every other legitimate sender.
- DKIM is generated, published at the exact selector and started in Gmail authentication.
- DMARC is published after SPF/DKIM alignment is tested.
- External receipt, Gmail replies and every WordPress form or notification path have been tested.
- Propagation windows of up to 72 hours for MX/TXT and up to 48 hours for SPF/DKIM are allowed before escalating.
What a successful setup looks like
Visitors continue reaching the WordPress site through its existing A and CNAME records. The domain’s MX lookup returns Google’s mail destination, new Workspace users can receive messages from outside accounts, and outbound messages authenticate through SPF and DKIM. DMARC reports give you visibility into unauthorized or misconfigured senders. The key boundary is simple: manage web traffic with web records, manage mail with MX and authentication records, and make every change at the DNS service that the domain’s nameservers actually designate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
